[bluejeans117]

Three related pieces of credibility work, kept in one commit because the licence change and the security policy are the same argument: FlexDoc asks to be installed inside a production backend, and everything a stranger checks before agreeing to that currently fails.

Relicense to Apache-2.0

FlexDoc is designed to be linked into a proprietary application that serves users over a network, which is the situation AGPL section 13 addresses. Whether the copyleft actually reaches the host application is arguable — and the argument is the problem. Nobody opens a legal question to try a documentation library when the alternatives are Apache-2.0 and MIT, so the evaluation ends at the licence field and leaves no trace.

The copyleft was also protecting a renderer and a set of adapters, rather than the fleet aggregation and governance surface where the defensible value actually sits. That surface is separate code and keeps its own licensing options.

Every declaration moves together: LICENSE and the three adapter copies, the JavaScript, Rust, Python, PHP, Ruby, Elixir and .NET manifests, all three Maven POMs, the .NET workflow licence assertions, both showcase OpenAPI documents and the basic-usage footer. The licence text is the canonical Apache text verbatim, with the copyright in a header block rather than edited into the licence body.

Lockfile entries describing the published 3.4.0 artifact keep their AGPL metadata, because that is what was published. They change when the next release publishes — which is also when the relicense first reaches users.

DCO

Signed-off-by is now required, with inbound matching outbound. The README states that the embedded surface stays permissive and that any future control plane is separate code under its own licence.

SECURITY.md

Private reporting path, acknowledgement and fix targets by severity, supported versions per package line, coordinated disclosure and safe harbour. GitHub private vulnerability reporting is enabled, so the advisory link resolves.

It also names the design boundaries that are not vulnerabilities, so the policy does not invite reports it will reject: API Client scripts are trusted local JavaScript rather than a sandbox, host execution is privileged by construction with the operator's destination policy as the control, and credential scopes cover explicit auth fields only.

Dependency advisories

All twenty open advisories were third-party transitive dependencies outside shipped product code — eighteen in the go-gin example, five in the JAX-RS adapter's build dependencies. Bumped golang.org/x/crypto to 0.52.0, golang.org/x/net to 0.55.0, quic-go to 0.59.1 and jackson-databind to 2.18.9.

Worth stating plainly: this was never a product security problem, but it was always a credibility problem, since an evaluator seeing seven criticals had no way to know they were example dependencies.

Verification

• 332 JavaScript tests pass
• JAX-RS adapter: 12 tests pass, including the host-execution HTTP security suite
• go build and go vet clean on the updated example
• npm audit reports zero vulnerabilities
• check:example-versions passes — no published-artifact pins are disturbed

No renderer assets are touched, so no capture workflow run is required.